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■ Abstract 

o . 

i Tardos has proposed a randomized fingerprinting code that is provably secure against collusion attacks. 

We revisit his scheme and show that it has significantly better performance than suggested in the orig- 
inal paper. First, we introduce variables in place of Tardos' hard-coded constants and we allow for an 
independent choice of the desired false positive and false negative error rates. Following through Tardos' 
proofs with these modifications, we show that the code length can be reduced by more than a factor of two 
in typical content distribution applications where high false negative rates can be tolerated. Second, we 
study the statistical properties of the code. Under some reasonable assumptions, the accusation sums can 
be regarded as Gaussian-distributed stochastic variables. In this approximation, the desired error rates 
are achieved by a code length twice shorter than in the first approach. Overall, typical false positive and 
false negative error rates may be achieved with a code length approximately 5 times shorter than in the 
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original construction. 
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1.1 Digital fingerprinting 

Digital content, such as songs, photographs or movies, can be copied inexpensively without any 
loss of quality. Moreover, these copies can be easily redistributed without permission from the 
original rights holders. According to RW2004J, unauthorized sharing of music on pecr-to-peer 
(P2P) networks in college campuses reduces the potential revenue of the recoding industry by as 
Sh ' much as 20%. 



One way of countering unauthorized redistribution is to uniquely mark each individual instance 
of the originally distributed content, so that the recipient ('user') can be identified if that content 
appears on a P2P network. The authorized distributor (or the content owner) embeds a unique 
mark, also called a 'forensic watermark' or a 'fingerprint', into each instance of the content before 
transmitting it to the user. The embedding algorithm ensures that the mark is imperceptible, i.e. 
the quality of the content is not degraded by the mark. Moreover, the location and nature of the 
mark is kept secret from the user to prevent him from locating and altering the mark. Typically 
the mark consists of a set of symbols from a g-ary alphabet, where each symbol is embedded 
into a different part of the content, e.g. different scenes in a movie. When an unauthorized 
copy is found, the content owner, knowing all the details, can detect the mark and identify the 
source of the unauthorized copy. Forensic watermarking has already been successfully applied in 
practice [CNN2004] . 



1.2 Collusion resistance 

A group of recipients (called 'colluders' or 'a coalition') can collaborate to escape identification. 
Comparing their content copies, they can find the locations where their content, and thus their 
marks, differ. These locations are called the 'detectable positions'. By cleverly manipulating the 
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content at those locations, the colluders can attempt to create a version of the content that cannot 
be traced back to any of them. Such an attack is called a collusion attack. 

Collusion attacks and fingerprinting schemes that show resistance to these attacks have been 
studied since the late 1990's. The often used marking condition assumes that the colluders are 
unable to change the symbols (marks) in undetectable positions. Under the marking condition, 
one can distinguish between the following attack models, which differ in the type of manipulation 
the attackers are allowed to perform: 

• The restricted digit model or narrow-case model allows the colluders only to 'mix and match', 
i.e. to replace a symbol in a detectable position by any of the symbols they have received in 
that position. 

• The unreadable digit model allows for slightly stronger attacks. The attackers can also 
introduce an unreadable symbol '?' in detectable positions. 

• The arbitrary digit model allows for even stronger attacks. The attackers can put any (arbi- 
trary) (?-ary symbol (but not the unreadable symbol '?') in the detectable positions. 

• The general digit model allows the attackers to put any symbol, including the unreadable 
symbol '?', in the detectable positions. 

In the case of a binary alphabet all four attack models are equivalent. The content owner can map 
the unreadable symbol '?' to either of the binary symbols without loss of generality. 

Video fingerprinting applications face a number of severe constraints in practice. First of all, 
there is a limit on the number of locations (m) suitable for watermark embedding. A typical 
fingerprinting system can reliably extract approximately seven bits per minute of video con- 
tent [DCI2007 . Furthermore, constraints on decoding complexity and perceptual quality limit 
the number of different symbols that can be embedded in each location. Hence, the alphabet size 
q for a fingerprint code is limited (typically q < 16). Finally, mass market content distribution 
systems need to accommodate a very large number of users (e.g. millions or even hundreds of 
millions). Under these constraints, the authorized distributor is interested in the fingerprint code 
which can resist the largest coalition size (cn). 

In the last decade, various fingerprint codes have been proposed. Some of these codes are 
deterministic, i.e. they can identify at least one member of the coalition with certainty, without 
the danger of accusing an innocent user. For instance, Identifiable Parent Property (IPP) codes 
proposed in [HvLLT1998] are deterministic. However, the scheme is limited to a coalition size 
of two. In jSSW200"T] . Staddon et al. proved the existence of a deterministic fingerprinting code 
which is resistant against cq colluders. The code is of length m = Cq log 9 (n) , where n is the 
number of users. However, it requires an impractically large alphabet size, q > m — 1. Another 
deterministic scheme, presented in CFNB2000], has a similar length m = 4cQlogn with a smaller 
alphabet size q = 2cq. Still, the alphabet size quickly becomes prohibitive for mass market content 
distribution systems. 

When the application can tolerate a nonzero probability of error, randomized fingerprinting 
codes with smaller, even binary, alphabets can be used. In a typical fingerprinting application, 
the most important type of error is the False Positive (FP) error, where an innocent user gets 
accused. The probability of such an event must be extremely small; otherwise all accusations 
become dubious, making the whole fingerprinting scheme unworkable. We will denote by e\ the 
probability that a specific innocent user gets accused. The notation r\ is used for the probability 
that there exist innocent users among the accused. The second type of error is the False Negative 
(FN) error, where the scheme fails to accuse any of the colluders. In practical content distribution 
applications, fairly large FN error probabilities can be tolerated, as the content owner can collect 
evidence from multiple pieces of content over a period of time. We denote the FN error probability 
by £ 2 - 

In [BS1998] . Boneh and Shaw presented a binary (q = 2) randomized code with length m = 
0(cq In ^ In i), which uses concatenation of a partly randomized inner code with an outer code. 
They also proved a lower bound on the required length for any binary code that is resistant against 
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Co colluders: m > i(co — 3) In In [PSS2003] , Peikert et al. proved a tighter lower bound for a 
restricted class of codes with a limited number of 'column types': to = Q(cq In ^-). 

In |Tar2003] . Tardos further tightened the lower bound for the arbitrary digit model and the 
unreadable digit model: to — f2(cg In ~) for arbitrary alphabets. In the same paper, he described 
a fully randomized binary fingerprinting code achieving this lower bound. This code has length 
to = lOOc gfln^-]. 

While [Tar2003] proposed a practical code with optimal behavior for large cn, it leaves a number 
of open questions: 

• The author uses a number of arbitrary-looking constants in his proofs, such as 20, 
2(Jc^' 3ooc • Similarly, the constant 100 appears in the minimum code length expression 
to = 100c§ [In . While these numbers allow for important properties to be proven, it is 
not at all clear if they have been chosen in an optimal way. 

• He also makes seemingly arbitrary choices for the accusation weight function — which specifics 
how strongly to accuse a user per symbol if his symbol is equal to the symbol found in a 
pirated copy — and the distribution function — which specifics probabilities used in generating 
the random code words, — hinting that they are optimal, but not providing a proof. 

• In the proofs, the FN error probability £2 is coupled to the FP probability e\. While Tardos 
remarks that they can be decoupled, it is not clear how each exactly influences the code 
length on its own. Furthermore, the coupling is such that FN rate is much smaller than the 
FP rate, £2 -C e\. As mentioned earlier, in practical applications the opposite £2 3> £1 may 
be desirable. This opposite case is not studied. 



1.3 Contributions and outline 

In this paper, we provide answers to the aforementioned issues with Tardos' construction, which 
were left open in |Tar2003] . 

• In Section 12. 2[ we generalize the Tardos' construction, introducing variables in place of 
numerical constants and generic functions instead of the functions specified in |Tar2003j . 
We state 'Soundness' and 'Completeness' properties, which specify the desired FP and FN 
error conditions. Our approach is similar in spirit to Hagiwara et al.'s in HHI2006], but our 
results are not restricted to small coalitions. 

• In Section 13 - 1 1 we state the conditions on the construction parameters for a scheme that 
satisfies both the 'Soundness' and 'Completeness' properties. These conditions arc derived 
in Sections 13.21 and 13 .31 respectively. We employ a proof method very similar to [Tar2003 , 
but we specifically do not couple FP and FN error rates. In Section I3T41 the results of the 
preceding subsections are combined to arrive at a condition for the code length. 

• In Section [3~5l we show that Tardos' choice for the accusation weight function is optimal. 
In Section [3.6[ we show that his choice for the distribution function used in generating the 
random code words is optimal within a limited class of functions. 

• In Section 13. 71 we arrive at the smallest possible code length parameter value, specific for 
our proof method, that allows for Soundness and Completeness. In the case of large cq, this 
value lies slightly above 47r 2 , which is a significant improvement over the original value '100'. 

• In Section [4] we present the results of a numerical search for model parameters that yield 
the shortest possible code length. For certain realistic choices of n, Co, £1 and £2, we find 
that the code length can be reduced by a factor of two or more. For large £2 our theoretical 
large-co result seems to be approached. 
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• In Section [H we further see that the code length depends only weakly on £2 , as was also 
mentioned by Tardos. Nonetheless, we observe a significant advantage for decoupling the FP 
and FN error probabilities. When Tardos' coupling of £2 = £i°^ 4 is enforced, the code length 
constant TOO' can be reduced only to approximately 90. When the rates are decoupled and 
the FN rate is allowed to increase, for fixed E\ and cq values, the constant can be reduced 
to approximately 45. 

We also study the statistical properties of the scheme. The results give us an insight into the 
'average' behavior of the scheme and are much simpler than the expressions involved in the formal 
proofs. 

• In Section f5.il by modeling the accusation sums as normally distributed stochastic variables 
(an approximation motivated by the Central Limit Theorem), we state a simple approximate 
condition for the code length based on the coalition size, FP and FN error rates. 

• In Sections 15.21 and 15.31 we compute the mean and the variance of the accusation sums for 
innocent users and the coalition, without any assumptions on their distribution. Similarly, 
we derive conditions on the code length and the accusation threshold based on the desired 
false positive and false negative error rates, in Section 

• In Section 15.51 we identify an 'extremal' colluder strategy. It maximizes our expression for 
the minimally required code length. The strategy is to output a '1' whenever this is allowed 
by the marking condition. 

• In Section 15.61 we assume that the probability distributions of the accusation sums are 
perfectly Gaussian. Using this approximation, we show that (for large Co) error rates S\, £2 
can be achieved with code length m « 27t 2 Cq In ~. The Gaussian approximation is justified 
in Appendix [C] 

2 Tardos revisited 

2.1 Generalization 

In |Tar2003j . Tardos proposed a randomized fingerprinting code resilient against collusion attacks. 
His fingerprinting scheme is particularly known for its short code length. Nonetheless, due to a 
number of implicit parameter choices in Tar2003j , it is not clear if his explicit construction achieves 
the shortest possible code length allowed by the scheme. In this section, we generalize Tardos' 
construction in anticipation of our study in the following section. In particular, we make three 
generalizations. First, we replace various fixed numerical parameters by variables and investigate 
the conditions on these variables that allows us to still carry out the security proofs. This helps us 
to modify the system parameters so as to obtain even shorter code lengths. Second, we allow for the 
desired false positive and false negative error probabilities to be chosen independently. As opposed 
to the original construction where these probabilities were coupled, this generalization allows us to 
better align the scheme to practical content fingerprinting requirements. Third, we do not assume 
any specific form for the functions /, 171 and go (see Section 12.21) in Tardos' construction. The 
introduction of arbitrary functions /, gi, go leads to a lot of extra effort in carrying out the proofs. 
However, with this generalization, we can show that Tardos' choices for gi, go are optimal (for 
the proof technique employed in [Tar2003j). and that his choice for / is likewise optimal within a 
specific class of smooth functions. 

2.2 Notation and definitions 

We describe our generalized version of the binary Tardos fingerprinting scheme below. We adhere 
to the notation in |Tar2003] whenever possible. Moreover, we denote the explicit parameter choices 
made by Tardos by the superscript 'T' to avoid confusion. 
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The fingerprinting scheme has n recipients ('users'). Each user is assigned a codeword of 
length m. The set of colluders (the coalition) is denoted as C, whereas the number of colluders 
is denoted as c. The coalition size up to which the scheme has to be resistant is denoted as cq. 
The content owner generates an n x to matrix X; the j-th row of X is the codeword embedded 
in the content of user j. The part of X received by the coalition is denoted as Xq- The colluders 
use a 'C-strategy' p to produce an m-bit string y = p(Xc) which ends up in the unauthorized 
copy. The strategy p can be deterministic or stochastic. The content owner uses an accusation 
algorithm a. The output of the algorithm is a list of accused users. 

The matrix X is constructed in two phases. In the first phase a list of random numbers 
V = {Pi\iL\ is generated, where pi G [t, 1 — t), with t a small parameter satisfying cot <C 1. The 
Pi are independent and identically distributed according to a probability distribution function /. 
The function / is symmetric around Pi = \ and heavily biased towards values of Pi close to and 
1. In the second phase, the columns of X are filled by independently drawing random numbers 
Xji G {0,1} with F[Xji =1]=jh. 

Having spotted a copy with embedded mark y, the content owner computes an 'accusation 
sum' Sj for each user j according to 

where go and g\ are the 'accusation functions', and y t denotes the i'th bit of y. The decision 
whether to accuse a user is taken as follows: if Sj > Z 7 then accuse user j. Hence 

a(X,y,p) = {j\Sj> Z}. (2) 

We note some properties of this construction. If the received mark yi is zero, the accusation of 
user j due to column i is neutral. If yi = 1, the accusation sum is updated by gxu (f>i)j which is a 
measure of how much suspicion arises from observing yi for a given X 3 i and pi . The function g\ (p) 
is positive and monotonically decreasing. The fact that user j has received a '1' in that position, i.e. 
Xji = 1, adds to the suspicion. Moreover, the amount of suspicion decreases with increasing pi, as 
the symbol becomes more probable. The function go(p) is negative and monotonically decreasing. 
Therefore, the fact that Xji = detracts from the suspicion, and this becomes more pronounced 
for large pi. We impose two properties on the accusation functions go and g±, which become handy 
during our proofs. First, we want to have the expectation value of the accusation in each column 
to be zero. Therefore, the functions should satisfy pgi{p) + (1 — p)go{p) — 0. Furthermore, we 
want the weights of the accusation for X = and X = 1 to be symmetric, since the function f(p) 
also has <-> 1 symmetry. This is achieved by setting go{p) — — <7i(l ~p)- These two properties 
together imply that (a) go can be computed from g\ according to go(p) — —giip) ■ — p) 
and (b) g\ on the interval (5, 1 — t) can be derived from g\ on the interval (t, ^) according to 
9i(p) = ~ P) ' (1 ~ p)Ip- Hence it is necessary only to specify gi(p) for p G (t, i). 

The FP parameter e 1; chosen by the content owner, denotes the desired bound on the probabil- 
ity of having j G u(X, y,p) when a fixed user j is innocent. The FN parameter e 2 j also chosen by 
the content owner, denotes the desired bound on the probability that a(X,y,p) does not contain 
any guilty user. 

The Tardos fingerprinting scheme uses a code length to and a threshold Z with the following 
scaling behavioiQ as a function of n, £\ and Co'. 

to = Acl [In 1 /ei] ; Z = Bc [In 1 /e{\ . (3) 

Here we have introduced the parameters A and B, replacing Tardos' constants 100 and 20, re- 
spectively. We want the scheme to satisfy the following properties. 

1 The constraint <?j(p) < on the whole interval (t, 1 — t) gives the additional condition g^(p) > — p) ■ This 
can be satisfied by writing gi(j>) = exp J p dp' Q(p') with — < Q(p) < 0. 

2 Note that J3} has no explicit ^-dependence. The dependence enters implicitly through A and B. However, 
as will be shown in Section|4] the £2-dependence vanishes in the limit of large cq. 
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Definition 1: 'Soundness' 

Let £\ € (0, 1) be a fixed constant and let j be an arbitrary innocent user. We say that the 
above described fingerprinting scheme is £i-sound if, for all coalitions C C [n]\{j}, and for all 
C-strategies p, 

P[False positive] = V[j G cr] < e\. (4) 

Definition 2: 'Completeness' 

Let £ 2 £ (0, 1) and cn £ N + be fixed constants. We say that the fingerprinting scheme is (cn, £2)- 
complete if, for all coalitions C of size c < cn, and all C-strategies p, 

P[False negative] = P[C n cr = 0] < e 2 . (5) 

Tardos proved (for cq_^> 7) that his scheme is Sound and Complete for the following very specific 
choice of parameters 



f T iP) = -77, , = ri 9I(P) = 5 T (P) = 



= 100; B T = 20; i T - ' 



300c 

co/4 (6) 



where t' = arcsin 



3 Proving a shorter code length through parametrization 
3.1 Main result 

The main aim of this paper is to show that it is possible to satisfy Soundness and Completeness 
in Tardos' scheme also with different choices, especially with a smaller parameter A and hence 
shorter code length m. While the choice A T — 100 does the job for cq > 7, we will show that it 
can be reduced to a number slightly larger than Air 2 in the limit of large cn, when £2 is not coupled 
to ex. Our results can be summarized in the form of the following theorem. 

Theorem 1: Let e±, £2 £ (0, 1) be fixed parameters. Let the cutoff parameter t be parametrized 
as t = t/cq, with < t < 1. Let Co satisfy 

Let oj <C 1 be a positive constant. Let the quantities D, S and £ be defined as 
D := e(w/1.7) 2 



q.7 ^0 rr+^v^F 



(5 := 2T + 7rcj + e i -'— — r-D T 



C := + (8) 

V 7TCJC0 m£l 

Let the length m and the threshold Z in the generalized Tardos scheme be parametrized according 
to ([3]). Then it is possible to find functions f(p), gi(p) such that the parameter setting 

achieves £i-soundness and (co, £2)-completeness. 

3 In ITar2003l the distribution / was given in terms of a uniform random variable r, defined according to 
p = sin 2 r. 
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Corollary 1: In the limit of large en, ei-soundness and (cq, £2)-completeness can be achieved by 
a code of length 

m = ^ 2 7r^T 7j[l + <?(-)] '^ In ^. (10) 

The proof of Theorem Q] is given in the coming sections; we follow Tardos' proof method 
wherever possible. We derive the conditions for Soundness and Completeness in Sections 13.21 
and 13.31 respectively. We combine these conditions in Section 13.41 and obtain the lowest possible 
value of A that allows for Soundness and Completeness, depending on the specific choice of the 
functions / and g\. In Section [3~5l we prove that g\ = gj is the 'optimal' choice, independent 
of /, in the sense that this choice minimizes this lowest value of A (given the proof method). In 
Section r3.6[ we argue that, given 171 = gj , the choice / = / T is 'optimal' (in the same sense) within 
a limited class of functions. Finally, in Section [3771 we set f = f T and g\ — gj and complete the 
last step of the proof. 



3.2 Condition for Soundness 

This section follows the lines of Tardos' proof of Theorem 1 in [Tar2003J. We derive an inequality 
for the scheme parameters from the requirement that the Soundness property holds. 

First, an auxiliary variable ot\ > is introduced for the purpose of applying the Markov 
inequality. (Tardos uses aj = l/(10co).) 

P[? 6<r]= F[Sj >Z}= P[e a ^ > e QlZ ] < yXp J iZ 1 ■ (11) 

Here the notation E yXp denotes the expectation value computed by averaging over all stochastic 
degrees of freedom: the (possibly stochastic) yi, all the entries in X and the parameters p;. The 
expectation value in ([TTj) is bounded by using the inequalitjQ e u < 1 + u + u 2 , which holds for 
u < 1.7. Using the notation Uj = g Xji {Pi), we can write 

E Xj [e aiS i]= [] E %[e ai "']< II (l + aiEx^N+ai^i^-]) (12) 

i-Vi = l i:j/t=l 

Here E Xj stands for the expectation value over the j'th row of X, keeping the rest of X fixed, and 
keeping {yi} and {pi} fixed. Note that y is independent of Xj since the user j is innocent. The 
inequality (|12| holds as long as ol\ is so small that ot\Ui < 1.7 for all i for which = 1. This is 
automatically true for those columns where Xji = 0, since go is negative. In the other columns, we 
need OLigiijPi) < 1.7. Since pi > t and g\ is monotonously decreasing, we can satisfy the inequality 
for all X by setting a x < af ax := l.l/gx{t). 

Next we further bound (jT2|) . Due to the property p<7i(p) + (l —p) go (p) = we have Ex« [ui] = 0. 
Thus we can write 

m 

E Xj [e a ^]< J] (l + c%E Xji [ifi)<R(l + c%E Xji [ij$\). (13) 

i:yi — l i—1 

Note that all dependence on the coalition strategy has disappeared in the last expression. 

Next we take the expectation value of (fl3|) . for fixed {p;}, over the remaining degrees of freedom 
in X (all rows except j) and over {y^}™ x . This has no effect on the last expression in (fT3|) . Finally 
we take the expectation value E p w.r.t. the pi degrees of freedom. We remind the reader that this 
amounts to multiplying with the distribution function ]X*=i f(Pi) an( l integrating over all pi. For 
ease of notation, we introduce the functional v, defined as 

v := E p [E x Ju 2 ]} = j\p f(p) |p[.gi(p)] 2 + (1 -p)bo(p)] 2 | = 2^ V dp f(p)-2-[ gi (p)f. (14) 

4 One may ask why this crude inequality is used when our purpose is to squeeze the scheme's parameters as 
tightly as possible. The answer is that we do not want to deviate from [Tar2003| too much in this paper, as it would 
lead to even more bookkeeping than is already the case. It would be interesting to determine the consequences of 
using an inequality of the more general form e u < 1 + ru + su 2 , with r > 1. 
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(With Tardos' choice for g%, this evaluates to v = * dp/(p) = 1). We can then write 

m 

E yXp [e aiS >] < + i/o?) < e m "< (15) 
t=i 

In the last step we have used 1 + u < e u , which holds for all u. Substitution of (fTS"|) into (jlip 
finally gives 

P[Sj > Z}< exp(mi/a 2 - a%Z). (16) 
As (|16[) holds for all a± in the allowed range, we can write 

P[Sj > Z] < min exp(r?wa 2 — a±Z). (17) 

Ql£(0,Q5 nax ) 

The minimum of the parabola in the exponent lies at a\ := Z/{2mv). Hence, the minimum in 
(fT"7|) is obtained by setting a± = a*. Note that this is allowed only if af lax > a\; this condition 
can be rewritten as 

Co - 3^J- (18) 
If Co is large enough for the condition to be satisfied, then it holds that 

¥[S 3 > Z}< exp(m^K] 2 - a\Z) < ef ,[ivA) . (19) 

In the last inequality we have used a* = Z/{2mv) and the parametrization (|3|). From (| 19|) and 
Definition [T] we conclude that, for Co large enough so that IT8|) holds, £i-soundness can only be 
obtained if 

R 2 

A < —. (20) 



3.3 Condition for Completeness 



This section closely follows the proof of Theorem 2 in [Tar2003] . We derive an inequality for the 
scheme parameters from the Completeness requirement. First, the coalition's accusation sum S is 
defined, 

m 

S = =^2yi{xi9i(Pi) + [c- Xi]g (pi)}. (21) 

jec t=i 

Here xi = ^2j eC Xji denotes the number of colluders that have a '1' at the i-th position of their 
codeword. (The size of the coalition is c = |C|. We consider the case c < en.) Since S > cZ would 
imply that at least one colluder gets accused, the false negative error probability can be bounded 
by 

P[Cno- = 0] <P[S<cZ}. (22) 

An auxiliary constant a 2 > is introduced for the purpose of using the Markov inequality (Tardos 
chooses = l/(20c )), 

F[S < cZ] = P[e-" 2S > e- a2cZ ] < V ^ 2CZ ■ (23) 

Upper bounding the expectation value ¥* y x P [e~ a2S ] is an arduous job. The derivation is given in 
Appendix [Al It turns out that E y x p [e~ a2S ] < exp(—a2m/L), with L > a numerical constant, 
provided that c, L, t and a-2 satisfy a complicated condition (|88|) . (Tardos has L T = 4). Thus we 
can bound the false negative probability as 

P[C n cr = 0] < exp(a 2 cZ - a 2 m/L) < exp(a 2 c Z - a 2 m/L). (24) 

Substituting the parametrization ^ into (f2"4")l . and restricting ourselves to the regime A > LB, 
we get 

P[C 0(7 = 0] <£ ^ A / L - B \ (25) 
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Next we demand Completeness, P[C n a — 0] < £2. This yields the following inequality, 

A>LB+±^. (26) 
012% lnei 



Note that (|26|) is valid only if the complicated condition ([88)1 is satisfied 

3.4 Conditions on the code length 



By combining the results of Sections 13.21 and 13.31 we derive a condition on the length parameter 
A that is sufficient for proving Soundness and Completeness using the current proof technique. 

Lemma 1: Let £i,£2 <= (0,1) be fixed parameters. Let the code length m and the threshold Z 
in the generalized Tardos scheme be parametrized in terms of the A and B parameters according 
to ([3]). Let the threshold t be set as t = t/cq, with r<la positive constant. Let Co be a fixed 
integer, satisfying 

C0 * 7(3-LF (27) 



Let «2 be the auxiliary parameter introduced in Section 13.31 Let L be the parameter introduced 
in Section l3~3l chosen such that the condition ([55)) can be satisfied by some value a-z- Let v be 
the functional of / and g\ as defined by (fTl")) . Let ip be defined as 



*=Jl + -f^^-l. (28) 
y vLa.2CQia.e1 

Then the generalized Tardos scheme with 

A = AvL 2 (\ + ?/)) 2 ; B = 4jaL(1 + V) (29) 

is £i-sound and (en, £2)-complete. 

Corollary 2: Let «2 be parametrized as «2 = w/cn, with w < 1 a positive constant. Let the 
function gi(p) be such that it has the asymptotic behavior gi(p) cx jT 1 at p = t, with 7 < 1. Then 
for large Co, it is possible to achieve Soundness and Completeness with A = 4vL 2 [l + (9(l/cn)]. 

Proof of Lemma [7] The value of cq in (f2"T)l is specifically set such that (JT5J) is satisfied, and 
hence we are allowed to use the inequality (|2"0]) . By combining the results ([20]) and ((26)) we obtain 
a 'window' for A in which Soundness and Completeness are both satisfied, 



Ae 



LB 



L hi£ 2 B 



U2cf ) hl£i 4f 



(30) 



We choose B such that (i) this window exists, and (ii) the left boundary is as small as possible. 
It turns out that the optimal choice for B is the smallest value for which the window still exists. 
Setting the left and right boundary in (|30[) equal to each other and solving for B gives 

S opt =4r/£(l+V>), (31) 

with V> as defined in (|28|) . The corresponding value for A is A opt = B 2 pt /(Av) = AvL 2 (l + ip) 2 . □ 
Proof of Corollary [D First we show that the quantity L > is well defined in the limit 
of large cq. To this end we inspect (|88[) . setting c = cq. We start with the term involving 
A = e[oj/1.7] 1 /' 1_ ^- ) < 1, (with oj < 1 and j-Lg > 1). The exponent Co — x max , with x max defined 
satisfies 

1.7(1 -t)cp 

CO - Imax > T H p— : r~. (32) 

^3i( T /co) 
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From the choice gi(t) oc t~ 7 , with 7 < 1, it follows that Co — x max = 0(cq~ 7 ), i.e. an increasing 
function of en. Hence the expression A Co_;Emax / (1 — A) decreases as exp[— AcJ f ] for some positive 
constant A. For large cn, this is much faster than the term Q.2/L = lv/cqL. 

Next we look at the term vcoa 2 . This can be written as a^vui. Hence, the factor multiplying 
a.i is a small constant independent of cq. 

In the term a2CoE p [p c ° gi(p)], the factor multiplying oli can be written in the form 

i-X— t/c j 

c E p { P c ° gi (p)] = [pf{p)gi{ P )p%l T T / / c : o - / dpp c °-\pf(p) gi (p)]. (33) 

In this form, it is clear that the expression is finite for en — > 00, provided that the product f(p)gi{p) 
is non-pathological near p = 1 — t. 

The remaining term in (155)) is Qt2'YTx=x (^)^x° und j where K x ° uad is some nonnegative number 
that upper bounds the expression K\^ x as defined in ([75]) . From (Tf5|) it follows that 

K^ x <tf(t) gi (t)t x (i~ty<>- x + Jd P p x (i- P y°-*±(pf gi ), (34) 

where J is defined as the interval (or set of intervals) on which gj(p/<?i) > 0. Using the expression 
(|34|) as our bound K x ° und and computing the x-sum we obtain 

CO — 1 / \ /. 1 

E [x) K * OUnd = - (! - *) C0 - iC °] + / 7 d P [!-(!- P) C ° ~ P CQ ]^(P/31)- (35) 

Expressed in this form, it is clear that this contribution is of order 1 — (1 — t) c ° = 0{t) for Co ^> 1. 
The smallness of all the expressions in (|88|) implies that L is well-defined. 

The last step in the proof of Corollary [2] is the asymptotic behavior of the factor (1 + ip) 2 in 
(|2"5)) . The fraction 1/{cx.2Cq) in the definition (|28p of -0 is equal to l/(wco), i.e. of order 0(l/cn). 
Consequently, (1 + V) 2 = 1 + O(l/c ). □ 

Note that the expression 4i/L 2 in Lemma [1] originates from the specific proof technique. 

The next step in the proof of Theorem Q] is to choose / and g\ such that the product vl? is 
minimized. We refer to this choice as 'optimal', but it should be clear that it represents optimality 
only with respect to the proof technique that we employ in Section [51 



3.5 Finding the optimal g± function 

Lemma 2: For all distributions /, Tardos' choice g\ = gj is optimal in the sense that it minimizes 
the factor vL 2 appearing in the length parameter A in Lemma [T] This choice yields v = 1. 

Proof: We have to solve an optimization problem and determine where the functional derivative 
of AvL 2 is zero. This is easiest to accomplish by choosing as the independent degrees of freedom 
f(p) and s(p) :— pf{p)gi(p) on the interval p 6 (t, 1/2), instead of / and g\. 

From (|88p it can be seen that L depends on / and g\ only through s(p): The expression 
E p [p c f/i] involves only the product fg\\ and K x '° und is a bound on (f75j) . which also depends on / 
and gi solely through the product fg%. 

The parameter is, on the other hand, depends on both the s(p) and f(p) degrees of freedom; 
Eq. (fT4"]) can be rewritten as 



1/2 
dp 



P(l -P)fip)' 



(36) 



The functional that wc have to minimize is 



F[ Sl f]=^[sJ]L 2 [ s ] + \ 



1/2 



dp f(p) - 1/2 



(37) 
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where A is a Lagrange multiplier for the normalization constraint on /. Setting the functional 
derivative with respect to f(j>) equal to zero gives 



Hence, since the normalization of g\ is arbitrarjQ , it turns out that Tardos' choice gi{p) = gj(p) = 
y/ (1 — p)/p is optimal. 

From the optimal gi the value of v follows directly, without dependence on /: Substituting gj 
into (|14p and using the fact that / is a normalized probability distribution, we get v = 1. □ 

3.6 The choice f = f T seems to be optimal 

Having found the optimal g\ , we can next search for the optimal distribution function /. The terms 
proportional to ati in the left hand side of (|88[) are the most important in determining the allowed 
values of L: we want to tune / such that the number multiplying a 2 is as negative as possible. We 
have looked at a class of smooth functions of the form f(p) = r ! p a ~ 1 (l—p) b ~ 1 /[B 1 / 2 (a, b) — B t (a, b)) 
on the interval p € (t, 1/2), where B is the incomplete Beta function. Numerical inspection shows 
that Tardos' choice a = b = \ is the best choice for a, b. Of course, as we have not investigated 
the full function space of /, this does not prove that / T is the best possible choice. 
In the rest of this paper we will work with / = / T . 

3.7 Last step in the proof of Theorem Q] 

We are now finally in a position to prove Theorem Q] We show that Theorem Q] follows from 
Lemma Q] in the special case / = / T and gi — gj ■ In this special case, we have v = 1 as shown 
by Lemma [5J Hence the condition on cq (|2"T|) reduces to (J7J. Furthermore, the choice g\ = gj 
gives = k (see App. \K§, whereby A reduces to D, as defined in (JSJ). Next we use the property 
■^[pf T gJ] = to explicitly evaluate the E p expectation and the K^ ound term in (|88|) . We make 
use of expression ([35]) for K^ onnd and get 

(l-*) CQ -i C0 . ^VccA . ound _ 1 - (1 - ty° - i c ° 



x=l 



This allows us to rewrite 

1 _ a2 { 2 ^ - - 1 _ a; - e 1 - 7 , °° m^-'^l < X _ . ( 40 ) 
\ 7T - 4f w(l - D) J L v 7 

The quantity 5 in Theorem [1] is specifically chosen such that L = 7r/(l — 6) satisfies (|40)) . The £ 
in Theorem[T]is given by ip (|28|) after the substitution i/ = 1, «2Co = w, L = -k/{1 — S). Thus, |29ll 
reduces to ((9j. □ 

4 Numerical evaluation 

In the preceding section, we proved a result for large coalition sizes. In this section, we numerically 
investigate how quickly convergence to this behavior occurs. 

4.1 Method 

Given that / T and gj are the optimal functions, we determine the optimal values for the remaining 
parameters. For fixed (co, £1,62)1 our task is to find (t, at, cx.2, L, B) such that we obtain the 
smallest possible A. We mean 'smallest' in the sense that Soundness and Completeness can be 



As can be seen from the accusation rule rescaling g\ and Z by the same factor leaves the scheme invariant. 
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proven using the technique in Section^ but without the assumption that cq is large. The following 
constraints must be satisfied: 

• From (HHJ), © and the required property P [false positive] < E\ we get the constraint 

- Ac\a\ + Bcuax < 1. (41) 

• Similarly, from (1241) . ([3]) and the required property P [false negative] < e 2 we get the con- 
straint 

(-B + A/L)c 2 a 2 In ei < In e 2 . (42) 

• In Section [3.21 the parameter a% was introduced such that ot\ < 1.7/(?i(t). This gives 



ai < 1.70/(1-4). (43) 

• In Appendix 1X1 it is assumed that a 2 is so small that the function (1 — p) c ~ x exp[ai2(cp — 
x)/^/p(l — p)] is a decreasing function of p in the vicinity of p = 1—t for all x € {1, . . . , c— 1}. 
Let's denote this function as z(j>). Its derivative near p = 1 — t is approximately given by 
dz/dp w — z • (c — — p) _1 [l — 2^/i 2 _p ]- Hence, in order to ensure a negative sign of the 
derivative, a 2 has to satisfy 

a 2 ^ 20. (44) 

• In condition ((88]) with / = / T , g\ = gj the K^ ound term is easily evaluated. The resulting 
condition is 

2(l-i) c °-l , nco-zmax a 



with D = e(c a 2 /1.7) 2 and c - x max = [c i + 1.70(1 - t)/a 2 ~\ > 1. 
The complicated (^-dependence of (|45[) . containing a term of the form a 2 ^ a2 , prevents us from 



finding an optimum analytically. Instead, we have searched for optimum parameter values numer- 
ically, using a randomized method following these steps: 

1. Choose a random t uniformly from the interval (0, s^)- 

2. Choose oi\ uniformly from (0, min |l. 70/(1 — t), 2( ' 1 4 1 j). 

3. Choose L uniformly from ( 2(1 7 l7) 4 c '_ 1 , ^). 

4. Find the largest possible value of a 2 in the interval ^0, min ^20, ^ 2 ^ 1 ~^ 4 ° ; ~ 1 — j- jj that 
satisfies condition (l45l). 



5. Compute A = ( g^P L 



(c ai) 1 + -t 



1 In £ 2 



In ei 



Note that the optimal choice of B (in terms of achieving small A) follows from (f3T)]) . When the 
optimal value for B is used, the interval (f3T)]) consists of a single point seen in the last step. We 
repeat steps 1-5 multiple times and select the set of parameter values that yield the lowest value 
of A, i.e. the shortest code length. 
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4.2 Numerical results 

As the parameter A depends on e± and £2 only through the ratio of their logarithms, we define 
the parameter R = to display our results. This allows us to represent dependence on three 
parameters using only two variables, namely Abcst = ^best(co) R)- As we are primarily concerned 
with content distribution applications, we have chosen 1CP 15 < e\ < 10~ 9 and 0.1 < £2 < 0.5 as 
plausible values. This gives 0.02 ~ i? ~ 0.1. We further consider 10 < Co < 80. 

We plot the best code length parameter A as a function of Co (for constant R) and as a function 
of R (for constant cq) in Fig. [1] and Fig. [21 respectively. Note that these figures are derived from 
the same dataset. In Appendix [Bj we give the corresponding values of the t and B parameters, 
which are necessary to implement the fingerprinting scheme. The numerical results indicate that 
the result A ss 4ir 2 « 39.5 (see Corollary rjj seems to be approached for large Co and small R. 
Moreover, The i?-dependence of A is slightly sublinear. Note that there is not much variation in 
the value of A, only of the order of 15%. 

In Fig. [3l we also plot the results when the false positive and false negative rates are coupled as 
in |Tar2003] . i.e. £2 = £i°^ 4 or R = co/4. In this case, it is possible to reduce A to approximately 
90, which is not much of an improvement with respect to Tardos' A T — 100. This result further 
emphasizes the importance of decoupling FP and FN rates. When we allow for high FN rates 
£1 -C £2, the code can be safely made more than a factor two shorter than suggested in Tardos' 
original construction. 

Finally, the figures in this section, together with Appendix [Bj give a system parameter recipe 
for content owners who wish to implement a provably £i-sound and (cq, £2)-complete fingerprinting 
scheme with a code length A(R, cq)cq lner . 
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Fig. 1: Smallest obtained A as a function of cq 
for various values of R = ■ 



Fig. 2: Smallest obtained A as a function of 



R = -p-^ 2 - for various values of Cq . 



5 Statistical approach 

5.1 Motivation and main result of the statistical approach 

In this section, we put aside the provable properties of the Tardos fingerprinting scheme. Instead 
we study the statistical behavior of the accusation sums Sj ((T|) for the innocent user and S (|2"Tj) 
for the coalition. The advantage of the statistical approach is that we get more insight into the 
'true' behavior of the scheme (actual FP and FN probabilities as a function of m, Co, n, Z) than 
provided by the provable result (Theorem [T]) based on the Markov inequality. 

The accusation sums Sj and S are defined as the sum of a large number of stochastic vari- 
ables. We expect Sj and S to have an approximately Gaussian probability distribution. (This is 
motivated in Appendix [C]) The Central Limit Theorem states that a variable which is created by 
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Fig. 3: Smallest obtained A as a function of Cq 
in the coupled case R — cq/4. 



adding up many independent stochastic variables will have a Gaussian distribution in the vicinity 
of the distribution's peak. The exact size of this 'vicinity' depends on the distribution of the 
individual variables and on the total number of variables in the sum. In Appendix [C] we argue 
that the Gaussian approximation is valid for some realistic values of e% and m. 
Our main result can be formulated as follows. 

Theorem 2: Let £1,62 S (0, 1) be fixed parameters. Let cq e N + be a fixed parameter. Let the 
functions f(p) and gi(p) be given by / = / T , g\ = gj . Let the cutoff parameter t be parametrized 
as t = t/cq. Let the accusation sums Sj |T]) and S ([2"Tj) obey Gaussian statistics. Then the 
fingerprinting scheme with code length m and threshold Z set according to 



> 



z e 



2vr 2 



1 2 



(l-2r) 2 
2m Erfc mv 



Erfc 11 



(2ei 



'(2e 1 ) + — Erfc mv (2e 2 ) 
s/cq 



1 - 2t 
1 

ttcq 



12m 



Erfc inv (2e 2 ) 



(46) 
(47) 



is £i-sound and (cq, £2)-complcte. 



Here Erfc stands for the complementary error function 1 — Erf, with the definition Erf(x) = 
(2/1/7F) Jq dy e~ v . The superscript 'inv' denotes the inverse function. 

Corollary 3: Let (e\, £2) € (0, 1) be independent fixed parameters. Then for Co ^> 1 the param- 
eter choice 



2vr 2 



c n In- 



1 



2tt 



- (l-2r) 2 £i V2tt 
achieves ei-soundness and (cq, £ 2 )-completeness. 



1 - 2r 



c In- 



27T 



(48) 



The proof of Theorem[2]is given in the coming sections and has the following outline. First, in 
Sections 15.21 and 1 5 . 3[ we compute the lowest moments of the distributions of the accusation sums, 



fij := E y xp[Sj] 
/i := T&yXplS] 



EyXp [Sj 



where j is not a colluder 



:= E 



\S 2 ] - /i 2 



(49) 



Then, in Section 15.41 we compute the false positive and false negative error probabilities as a 
function of m, Z and cq. We derive conditions on m and Z from the Soundness and Completeness 
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requirements. In Section \5. 51 we identify an 'extremal' strategy which leads to a maximum value of 
<jj and a. In Section [5. 61 we assume that the probability distributions are Gaussian (a motivation 
for this step is given in Appendix [Cj and we combine all the ingredients to complete the final step 
in the proof of Theorem^ We prove Corollary [3] in Section [5~71 



5.2 Statistics of an innocent user's accusation 

Even without knowing the colluders' strategy, we can derive a number of useful properties of 
the expectation values listed in (f49|) . We start by looking at Sj, where user j is not a colluder. 
In Section 12.21 the functions gi,go were introduced such that pgi(p) + (1 — p)go(p) = 0. This 
immediately yields 

rn 

[Sj] = E V* E ^ [ U ( X H,Pi)\ = °» (50) 

where yi is shifted out of the expectation value because j is not part of the coalition. From (|50p 
it immediately follows that \ij = 0. 

The standard deviation Gj is computed as follows. Substitution of the definition Jl]) into (|49[) 
gives 

m m 

a) = EyXplS]} = J2Y,E yXp [y iVk U{X jhPi )U{X jk ,p k )}. (51) 

j=l k=l 

All terms with i ^ k vanish, since then the expectation value factorizes into two parts that are 
both zero due to ([517)) . Hence we can write 

m m 

o) = J2®yX P [yi U 2 (X JuPl )} = Y^^yXcP [Vi ®x }i [U 2 (X ji>Pi )]\ . (52) 
i=l i=l 

(Here the expectation K y x CP involves only those entries in X that are visible to the colluders.) 
Again we have used the fact that yi does not depend on Xji when user j is innocent. Next we 
make use of the property Ex,-i [U 2 (Xji,pi)] = 1 which holds for g\ = gj. This finally yields 

m 

cr] = ^EyXcpjyi] < m. (53) 

i=l 

5.3 Statistics of the coalition accusation S 

Next we look at the collective accusation sum S defined in (f2"Tj) . Now we have to keep in mind 
that yi depends on Xji when j is a colluder. Taking the expectation of (|2"Tj) we get 

m 

/x = E yXp [S] = ^E p [E x [E y [ yi }{x m ( Pl ) + [c-Xilgoipi)}}] . (54) 

i=l 

The notation E y stands for the expectation value over the y degrees of freedom for fixed p and 
X. In (|54[) the expectation value over X, for fixed p, reduces to a binomial distribution on the 
integers Xi )Tar2003j : 

P[#T entries in column i is x»] = y ° - pi) c ~ Xi . (55) 

We now evaluate (|54[) as follows. We express the Ex expectation in the form (|55[) . We define 
a quantity ipi( x i) := Ejf C p\i[Ej/[yi]]- Here the notation Ex cp \i means the expectation value over 
all degrees of freedom in Xc and p except column i. The quantity tpi depends on Xi and the 
colluder strategy (and possibly explicitly on i, if the colluders choose to apply different strategies 
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in different positions); it does not depend on pi, as the coiiuders do not have access to pi. Finally 
we substitute Tardos' functions gj, and / T . In this way we obtain, after some algebra, 



We now make use of the marking condition, giving ipi(0) = and ipi(c) — 1. This allows us to 
rewrite (|5B|) as 



^rz^E (i-*) c -* c +E ( c )te){(i-^ c ---^(i-^4 



(57) 



Note that the coalition strategy has an almost negligible effect on p. The terms (°)t x (l — £) C_:E 
add up to 1 when the full sum is taken, but only the x = term is of order 1. All the other 
terms summed together are only of order c$t = r€ 1. The same argument holds for the other 
summand, but there the x = c term is dominant. 

We use the same methods as above to evaluate a. Without showing the details of the compu- 
tation, we give the result, 



1 / r \ /" i_t ii 2 



a 2 

7T - 4* 

i—1 Xi — 1 



5.4 Relating m and Z to the error probabilities 

In (|53|57|58j) we see from the i-summations that the m-dependence becomes very simple if the 
coiiuders apply the same strategy in each column; namely, the quantities a 2 , \i and a 2 then all 
become proportional to m. This motivates us to define 'scaled' quantities as follows, 

2-2 -2-2 /rn\ 

<jj = m<7j M = m M °~ = ma ■ (59) 

Let us introduce the notation p\ and p2 for the probability distribution functions of Sj and S, 
respectively. These functions are unknown to us, but we normalize them so that they have zero 
mean and unit variance, 

V[Sj e[s,s + As}}= Pl (-)— ; P[5e[ V + A S ]] = p 2 (^)-, (60) 
a,j <Tj a a 

with da: pi(x) = 1 and dx P2(x) — 1. We introduce the cumulative 'tail' functions as 

Gi(x) = / dx'pi(x') ; G 2 (x) = / dx'p 2 (x'). (61) 



With this notation, the error probabilities are expressed as 

FP error prob. = G*i( — ) ; FN error prob. = G 2 ( °° - M ) ■ (62) 
a i u 

This is sketched in Fig. 01 The left curve is the probability density of the quantity Sj/ ' \fm. It has 
mean p,j = and variance &j ~ 1 (this will be shown in Section l5.5| . The FP error rate (which 
should be less than e±) is given by the area to the right of the (rescaled) threshold Z/y/m. The 
right curve is the probability density of the quantity -S/y/m. It has average -py/m and variance 
a/c. The FN error rate is given by the area to the left of Z/y/m. The horizontal axis is scaled 
such that the S^-curve does not depend on c and m. Several important properties follow from this 
picture: 
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Z/m 



1/2 









g/c\ 














e 





S m 1/2 /c 

Fig. 4: Sketch of the probability density of Sj/y/rn (left) and ^S/y/m (right). The accusation 
threshold Z and the desired error rates e\ and £2 are also shown. 



• For fixed m and Z, increasing c beyond Co affects only the distribution of S. The left curve 
remains unchanged and hence the FP rate is independent of the coalition size. This is 
compatible with the definition of ei-soundness (Definition [T|) . 



• The FP error rate is determined by one parameter: Zj 
Z oc y/m as far as the dependence on cq is concerned. 



Hence Z must be chosen as 



• When c increases, the rightmost curve becomes narrower and shifts to the left. In order to 
prevent the center of this curve (oc y/m/c) from crossing the threshold line, we need m = 
Q(c 2 ). Together with the previous point, this illustrates the need for the proportionalities 
m oc Cq , Z cx Co in the Tardos scheme. 

More precise results are derived next. 

Lemma 3: A sufficient condition for ex-soundness and (cq, £2 ^completeness is given by 



ze 



a j Gi nv (£1 ) , + — yf^l GT (£ 2 ) 



CO 



CO 



(63) 



Proof of Lemma{3\ The left boundary directly follows from the requirement Gx(Z/aj) < E\ 
the notation ([55]) . The right boundary follows from the requirement G2QC0Z — fj]/cr) < £2 



using 
□ 

Note that G 2 nv (£2) is negative on the interval £2 < 1/2 for symmetric G2, and that it mono- 
tonically increases as a function of £2. 

The Z-interval (|63[) exists only for sufficiently large m. One can think of a region in the (u, v)- 
plane, with u — ypm and v = Z, bounded on the lower side by a line v oc u and on the upper side 
by a quadratic function of u. The linear and quadratic curve meet each other at m = m m i n , 



-1 2 



Oj Grist) - - G™(e 2 ) 



(64) 



This represents the smallest possible code length for which the interval (fBU)) exists, and hence, by 
Lemma [21 the smallest possible code length for which the code is properly collusion resistant. 
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5.5 'Extremal' colluder strategy 

Eq. allows us to find the 'worst case' or 'extremal' colluder strategy. We define this as 
the strategy that causes the highest possible value of m m i n . Even though the colluders do not 
necessarily use this strategy, the content owner has to take into account that they might and has 
to adjust m accordingly. We make the following observations: 



• One way of increasing m m ; n would be to make jl as small as possible. However, in Section [5.3l 
it was shown that the choice of strategy has negligible effect on jl. 

• Another way of increasing m m j n is to make dj and a as large as possible. Here the choice of 
strategy has a big impact. Both dj and a are maximally large if the coalition outputs a '1' 
whenever possible. 

We see that the 'extremal' strategy is to set il>i( x i) = 1 f° r x i 7^ 0. (The marking condition 
enforces ^i(O) = 0.) It looks as if the colluders are incriminating themselves in those columns 
where pi < 1/2. However, for each symbol they equally incriminate a fraction pi of all the other 
users. The strategy derives its effectiveness from the large number of users who get accused along 
with the colluders. 

Substitution of the extremal strategy into and with c = c gives 



3 



7T - At' J t Jttcq 



r 2 



a + /i = c 



dp - p) c °- 3 / 2 = cq[1 - — L= + 0(— )] (65) 



7r — At' J t IJ-kcq Co 



5.6 Final step in the proof of Theorem [5] 

If Sj and S have a Gaussian distribution, then the functions G±, G2 become error functions, and 
we have 

Gi nv (ei) = V2Erfc inv (2 £l ) ; G£ v (e 2 ) = -y/2 Erfc inv (2e 2 ). (66) 
We obtain the following inequalities from l|65[). 



a-j < 1, ; a < ^/cq. (67) 



These are independent of the choice of strategy function ipi . Likewise, from 1|57[) we also obtain an 
inequality that is independent of ipi. This is done by taking only the negative part of the summand 
in (|F7|) and setting ipi = 1. The result is 

jl > X —^. (68) 

We substitute (|6^|) into (f6"5| and ([M]) . and then use the inequalities (167168^ . This exercise shows 
that the choice ([46]) for m is larger than m m ; n , as it should indeed be, and that the Z-interval (I47|) 
lies within the interval (|63|) . This completes the proof of Theorem [2j □ 

5.7 Proof of Corollary [3] 

We use the inequality |Wolj 



1 1 2 
ln-W - > 

X V 7T 



Erfc 11 



(69) 



to prove that the expression ln(l/Ei\/27r) in (|48|l is larger than [Erfc mv (2£i)] 2 . Thus the following 
code length achieves Soundness and Completeness, 
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We then neglect the term containing £2 with respect to 1, since it is of order 0(\/^/cq). This 
yields the value of to in Corollary [3J Finally, the value of Z in Corollary [3] follows by substituting 
this to into the left boundary in (|4"T)) . □ 
Remarks: In the regime e\ <C £2, the fraction of logarithms in (|70[) is typically smaller than 0.1 
(see Section [4j. Hence, the asymptotic result is already approached for relatively small values 
of c . 

In the case where £2 and £1 are coupled according to £2 = £ C ° , as was done in Tardos' 
original construction, Corollary [3] does not hold, as we get In £2 = (co/4)lnei. Here the fraction 
of logarithms is not negligible and leads to a factor (9/2)tt 2 in m instead of 2w 2 . 



6 Summary 

We have reevaluated the performance of the Tardos fingerprinting scheme by parameterizing its 
numerical constants and fixed functions. We have further modified the scheme by decoupling the 
desired false negative and false positive error probabilities. Using a proof technique similar to the 
one in |Tar2003] . we have shown how short the code length can be with provable £i-soundness and 
(co, ^-completeness. The main results of our study can be summarized as follows: 

• Tardos' accusation function gj is 'optimal' in the sense that it minimizes the provably 
sufficient code length for our particular choice of proof method. 

• Tardos' probability distribution function f{p) is 'optimal' in the same sense within a limited 
class of functions which has the form p a ~ 1 (l — p) b_1 . 

• For sufficiently large Cq values, and £2 independent of £1, the code length can be reduced 
from Tardos' 100c 2 , Iiie^ 1 to approximately 47r 2 c 2 l In eT/ 1 . 

• When £2 3> £1, for instance for content distribution applications, our numerical results show 
that a code length m < 46c 2 , In e^ 1 is achievable already for Co > 9. 

• For sufficiently large cq ^> 1, the accusation sums Sj for the innocent user and S for the 
coalition have probability distributions which are very close to Gaussian — due to the Central 
Limit Theorem. If these distributions are perfectly Gaussian, then, in the case of independent 
£1, £2, a code length of m ~ 27r 2 Cg InE] -1 is sufficient for achieving £i-soundness and (co, £2)- 
completeness. 



A Condition for Completeness 



In this appendix we derive an upper bound on the expression K y x p [e~ a2S }. The first part of the 
derivation is directly copied from Tar2003j, so we will not repeat it here. We start our analysis 
at the earliest point where the approach with general A, B, / and g deviates from [Tar2003 . 

From partial evaluation of the X-average (which involves the binomial distribution for each 
column of X separately) and from |i : j/» = 1| < to, it can be shown that 



E 



yXpl 



Eo,x 



< 



0,0 



Ei, c + ^2[ C ) max(£ 0!l ,-Bi,x) 



E p \p x {l-pf- x ] 



E„ 



p x (l - p) c x exp {~a 2 {x gi {p) + [c - x]g (p)y) 



p x (l-p) c x exp a 2 gi(p) 



cp — X 

' l-p 



The term E\^ c is easily bounded, 

Ei, c = E p [p c e- ca ^} < E Q . C - ca 2 E p [p c 9l ] + c 2 a 2 E> c 3 2 ]. 



(71) 



(72) 
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Next it is proven that (for x = 1 . . . c — 1) max(E\ >x , Eq <x ) < •En )X + some positive expression. To 
this end the inequality e" < 1 + u + u 2 is again used, which holds for u < 1.7. 



-p) c ^exp a 2 gi(p) 



cp — x 



< P *(1-pT- x 1 + a 25 i(p)f + a 2 2 



9i(p) 



cp — x 



1-p 



-B(a 25l (p)|-^-1.7)(:i -p)- ' <-x,, 



"251 (p) 



1-P 



(73) 



Here the term with the step function ensures that the right-hand side is always larger than 
the left-hand side, even if the expression in the exponent exceeds 1.7, which may happen for 
p (z (x/c, 1 — t) if a 2 is not very small. Taking the expectation value of (|73[) . we get 



with 



K 



l,x ■ — 



Ei,x < Eo,x + a 2 K ltX + a 2 K 2 , x + R x 



i — p 



(74) 



Pf9i- P x (l-P) c - X 



1-t r l-t 



+ 1 dpp x (l- p y- x —(pfgl) 



Kn 



R., 



P x {l~pf- X \gi{p) 



P =t 

cp — X 



1-p 



> 



B(a 29l (p)^_£-1.7) (I -,.)< "Yx,> 



cp — x 



at2gi(p)-, 

1-p 



> 0. 



(75) 
(76) 
(77) 



Now we have to upper bound K\ x by a nonnegative expression. Here we depart from [Tar2003 . 
Tardos makes a very specific choice for the / and gi function, namely pf{p)gi{p) ^constant. We 
keep the derivation as general as we can. For the moment we simply assume that we can find tight 
bounds K^ ound > such that 



K 1>a < K 



bound 



Then we have 



max^x, E hx ) < E Q>X + a 2 K^ ound + a 2 2 K 2>x + R x . 
Substituting and (J72J) into (J7T1) we get 

E ( f) - ^ + «2 E f f) ^ bound + "1 E ( I ) 



(78) 
(79) 



x=0 
c-1 



(80) 



The -En.ir term contains a sum over the binomial distribution and simply yields E p [l] = 1. The 
^2,0; term is bounded as follows, 



E l c W x <E p 



r^E(:)^a-^(-^ 



1-P J 



cv. 



(81) 



Next we bound the R x term. Note that the step function in (|77[) for fixed p is nonzero only if 
x < x max , where 

Zm ax := c(l - 1) - 1.7 ~ * <c. (82) 
"2ffl (t)_ 

Furthermore, we note that the function multiplying the step function in (|TT[) is monotonically 
decreasing as a function of p, provided that a 2 is 'small enough'. (This statement is made more 
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accurate in Section [?]). This means that the expectation value E p [-] can be upper bounded by 
evaluating the integrand at the point p = p* x , the smallest value of p where the step function is 
nonzero, 



R x < (l-p;) c -*exp 



a 2 (cp* x -x)j 



9i(p*x) 



with a 2 {cp* x — x) 



9i(P*x) 
1-pZ 



1.7. (83) 



We introduce a numerical constant (3 such that gi{p* x ) > (1 — P* x ) ■ (In Tardos' case (3 — 1/2). 
From the definition of p* x (1531 it then follows that 



r a 2 

(1-P X ) < [Yj(cp x -X) 



1/(1-/3) 



< 



- 7 {c-*) 



1/(1-/3) 



This gives us the following bound on R x for x < c 

' OL 2 



1.7 



R x < e 



The i? x -sum in ([80| can then be bounded as 



1.7 



(c-x) 



(84) 



(85) 



c-l 



x=l 



c-l 



x=0 



x=0 



1.7 



x=0 



a 2 



r x t^( c _ x ) 



c— x-a 



-,1.7 



e 1.7 A c- !c 



e(a 2 c/1.7) 1 -' 3 
1 - A x 



1 - 


e(a 2 c/1.7) T ^ ? 




ix+1 


1 




e(a 2 c/1.7p 


1 





1.7 a c— x n 



1- A 



<e L 'A 



1- A 



(86) 



where we have introduced the abbreviation A for the smalfl value e{a 2 c/1.7) 1 ^ 1 ^ . Summarizing, 
from (|5U|) we obtain 



c-l 



x=l 



1 - ca 2 E p [p c 9l ] + a 2 J2 ( j ^° Und + v<™ 2 2 + e X ' 7 A 



,2 i „1.7ac-i„ 



1-5 



(87) 



Finally we impose the following condition on the parameters t, a 2 : 

1 - ca 2 E p [p c gi } +a 2 J2 ( C ^j K x° und + vca\ + e^A^— < 1 - ^, (88) 

a;— 1 ^ ' 

where L > is a numerical constant. The satisfiability of this condition depends on the choice of 
/, g\ and L. Given that the condition is satisfied, we have the upper bound 

E yXp [e-^ s ] < [1 - a 2 /L] m < exp(-a 2 ^). (89) 

For given / and g\, we will be interested in the smallest value of L that can be achieved. Tardos 
chose t and a 2 such that L = 4. 

e As long as /3 does not deviate too much from the Tardos case, A is of order > 1 in the small parameter q?2- 
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B Numerical results 

Table 1 shows the results of the numerical experiments described in Section [U The values A, 
B and t parametrize the code length, accusation threshold and p-axis cutoff, respectively. We 
also note, for the sake of completeness, that the auxiliary variables take the following values for 
the parameter sets indicated in the table: 1.001 < L/ir < 1.026, 1.48 < a\/aj < 1.58 and 
0.05 < a 2 /aj < 0.30. 



Table 1: Numerical results 




-> c 


10 


15 


20 


30 


40 


60 


80 


0.02 


A 


41.31 


41.26 


41.16 


40.99 


40.85 


40.66 


40.54 




B 


12.86 


12.85 


12.83 


12.80 


12.78 


12.75 


12.73 




t/i r 


3.26 


2.25 


1.72 


1.00 


0.88 


0.50 


0.27 


0.04 


A 


42.80 


42.47 


42.21 


41.85 


41.59 


41.27 


41.06 




B 


13.08 


13.03 


13.00 


12.94 


12.90 


12.85 


12.82 




t/t' 1 ' 


2.96 


2.17 


1.44 


1.14 


0.77 


0.52 


0.43 


0.06 


A 


43.95 


43.41 


43.03 


42.50 


42.17 


41.73 


41.46 




B 


13.26 


13.18 


13.12 


13.04 


12.99 


12.92 


12.88 




t/i 1 ' 


3.41 


2.28 


1.53 


1.04 


0.65 


0.49 


0.37 


0.08 


A 


44.93 


44.22 


43.72 


43.07 


42.65 


42.13 


41.80 




B 


13.41 


13.30 


13.22 


13.13 


13.06 


12.98 


12.93 




t/i 1 ' 


3.16 


2.27 


1.71 


1.04 


0.77 


0.62 


0.33 


0.10 


A 


45.80 


44.93 


44.34 


43.58 


43.09 


42.48 


42.11 




B 


13.54 


13.41 


13.32 


13.20 


13.13 


13.04 


12.98 




t/i"' 


3.31 


1.94 


1.60 


1.23 


0.77 


0.46 


0.39 



C The Gaussian approximation 

Under some reasonable assumptions, we can regard the accusation sums as Gaussian-distributed 
stochastic variables. Here, we outline our assumptions and show that the Central Limit Theorem 
(CLT) is applicable under these conditions. We first note the complete column symmetry and 
column independence of both the code generation process and the accusation method. Given this 
symmetry, we argue (without providing a proof) that the best colluder strategy for generating 
the colluded copy is also symmetric, i.e. their output jji is independent of the column index i 
and independent of the Xc entries in the other columns i). Note that the 'extremal' colluder 
strategy of Section 15.51 also complies with this assumption. Given column symmetry and mutual 
independence of the accusation values, under the assumption of a symmetric colluder strategy, 
the accusation sums Sj are sums of i.i.d. variables, and the Central Limit Theorem (CLT) is 
applicable. 

We show that the domain of applicability of the CLT is large enough to encompass a sufficient 
part of the tail of the Sj and S distributions, so that the approximations made in Section 15.61 
are justified. The error probability S\ > 10~ 15 represents at most an '8-sigma' event, i.e. we are 
interested in the region of 8 standard deviations <jj around the average of Sj . 

First we determine the probability distribution of each separate accusation U(Xji,pi), for 
innocent j, given that yi = 1. We define, for infinitesimal Au, 

P[u<C/<u + AM]=^(ii)Aji. (90) 

We compute the conditional probability that U = u given Xji = 1. We write ip(u\X — l)du — 
f(p)dp, from which it follows that ip(u\X = 1) = f(p)dp/du. Using u — gi{p), with gi defined 
in |T]), we get tp(u\X = 1) oc 1/(1 + u 2 ). Applying the same reasoning to the case Xji = 0, with 
u = ga(jp), yields ip(u\X — 0) oc 1/(1 + u 2 ). From the conditional probability we obtain <p(u) by 
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multiplying with the probability that the event X — 1 (or X = 0) occurs, 



<p{u) = p^{u\X = 1) = (1 - pMu\X = 0) cx 1 (91) 

(l + u z y 



Here we have used the fact that p = 1/(1 + u 2 ) for X — 1 and p — u 2 / (1 + u 2 ) for X = 0. Thus 
the tail of the probability distribution has a 1/u 4 power law behavior. 

Next we argue that the number of contributing terms to Sj (almost m terms for the optimal 
colluder strategy) is sufficiently large for the CLT to cover 8 sigmas. For a distribution with 
vanishing third cumulant and with E[ii 4 ] < oo, it is known (see e.g. |Baz2005] ) that the region of 
convergence for the CLT, expressed in sigmas, is given by 

#sigmas= {^pj^ N^/\ (92) 

where N is the number of variables summed, and Kj stands for the j'th cumulant. Our distri- 
bution (|91[) satisfies the requirement E[u 4 ] < oo because f{u) is defined on the finite interval 

(-^Ap,-y^) U (yjj^, \f^)- We have n 2 = 1 + 0{Vt) and k^k\ = + 

Substitution into ([92]) . with N = m = 2n 2 c 2 ] lnej" 1 , gives 

#sigmas = (12tt 3 lne^ 1 ) 1 / 4 ^/ 8 ^ w 5.2cq /8 , (93) 

where we have used S\ w 10 -15 and t T = 1/(300cq). Hence, the 8-sigma point of the tail is 
correctly approximated by a Gaussian already at cq > 4. 
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